CWE-770: Allocation of Resources Without Limits or Throttling
The product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated.
A kind of CWE-400 Uncontrolled Resource Consumption.
From the CWE List. © The MITRE Corporation.
Newest
- @modelcontextprotocol sdk, server, modelcontextprotocol typescript-sdk +2 moreModel Context Protocol TypeScript SDK: One HTTP request within the default size limit could exhaust server memory during validation7.5 High
- modelcontextprotocol typescript-sdkMCP TypeScript SDK: Experimental tasks were not tied to the session that created them8.6 High
- @modelcontextprotocol client, sdk, modelcontextprotocol typescript-sdk +2 moreModel Context Protocol TypeScript SDK: HTTP client transports and OAuth requests followed cross-origin redirects and re-sent custom headers and request bodies6.5 Medium
- angularAngular: Denial of Service via RouterLink Query Parameter Retention in Server-Side Rendering (SSR)8.2 High
- @apostrophecms import-export, apostrophecms apostrophe +1 moreApostropheCMS: Unauthenticated resource exhaustion via pre-auth aposBigUpload processing in @apostrophecms/import-export7.5 High
- apostrophecms apostropheApostropheCMS: Unauthenticated CSV import requests leave rejected uploads in the system temporary directory7.5 High
- @apostrophecms form, apostrophecms apostrophe +1 moreApostropheCMS: Unauthenticated unbounded multipart upload → disk-exhaustion DoS5.3 Medium
- cloudflare https://github.com/cloudflare/pingoraPingora HTTP/2 server memory exhaustion through unbounded default header-list and concurrent-stream limits7.5 High
- ibm storage ts4500 libraryTS4500 Tape Library Denial of Service6.5 Medium
- python pillowPillow: GIF seek keeps rejected size after DecompressionBombError, allowing DoS8.7 High
- getgrav grav-plugin-apiGrav API Plugin before 1.0.42 Cache Exhaustion and Page Permission Bypass9.3 Critical
libcpanel-json-xs-perlDebian,perl-Cpanel-JSON-XSAzure Linux +1 moreCpanel::JSON::XS versions before 4.80 for Perl allow memory exhaustion by buffering incremental input past max_size in incr_parse7.5 High- aio-libs aiohttpAIOHTTP WebSocket frame reassembly permits excessive memory consumption from tiny reads8.7 High
- aio-libs aiohttpAIOHTTP: File descriptor exhaustion in multipart requests8.2 High
- aio-libs aiohttpAIOHTTP: Connector pool exhaustion via Max-Age overflow6.9 Medium
- aio-libs aiohttpaiohttp server lacks an initial request/header timeout8.2 High
- ibm mqIBM MQ Denial of Service6.5 Medium
- eugeny russhrussh agent server converts constraint records into unbounded never-rolled-back tasks4.3 Medium
- sgl-project sglangSGLang through 0.5.22 Memory Exhaustion via Mooncake STAGING_RSP chunk_idx7.1 High
- sgl-project sglangSGLang through 0.5.22 Memory Exhaustion via Unauthenticated Mooncake Decode Registrations7.1 High
- apache software foundation kylinApache Kylin: Potential computed-column resource exhaustion7.5 High
- giteaGitea Actions artifact v4 API unbounded request body6.5 Medium
- automatic1111 stable-diffusion-webuiAUTOMATIC1111 stable-diffusion-webui Metadata Extraction sd_models.py read_metadata_from_safetensors allocation of resources5.3 Medium
libtext-csv-xs-perlDebian,perl-Text-CSV_XSAzure Linux +1 moreText::CSV_XS versions before 1.65 for Perl allow memory exhaustion by allocating one entry per index of an RFC 7111 selector in fragment7.5 High- red hat enterprise linux 10, enterprise linux 6, enterprise linux 7 +6 more +8 moreLibtirpc: libtirpc: denial of service via unbounded memory allocation during rpcsec_gss decoding6.5 Medium
- pupnplibupnp chunked HTTP bodies can bypass g_maxContentLength and be fully buffered7.5 High
- csaf poc provider, gocsaf development community csaf provider +1 moregocsaf/csaf: csaf_provider prone to uncontrolled resource consumption8.7 High
- mattermost, mattermost server +1 moreMattermost local image proxy allows server memory exhaustion via unbounded image response buffering6.5 Medium
- mattermost, mattermost server +1 moreUncapped mention keys in user notification properties allow CPU exhaustion during post processing4.3 Medium
- nezhahq nezhaNezha 1.0.0 before 2.3.15 Memory Exhaustion via File Manager WebSocket7.1 High
- nezhahq nezhaNezha 2.0.13 before 2.3.15 Denial of Service via /api/v1/ws/transfer WebSocket7.1 High
- microsoft visual studio 2022 version 17.14, visual studio 2026 version 18.10, system.formats.cbor +2 moreASP.NET Core Denial of Service Vulnerability7.5 High
- bishopfox sliverSliver: Unauthenticated Memory Exhaustion Denial of Service in Sliver HTTP(S) Listener PNG Decoder8.2 High
- nodejs undiciundici WebSocket client vulnerable to Denial of Service via unbounded automatic PONG buffering5.9 Medium
- reactphp httpreact/http: Unbounded HTTP Client Response Header Buffering Leads to Memory Exhaustion DoS7.5 High
- nodejs undiciundici vulnerable to Denial of Service via unbounded memory in the EventSource parser5.9 Medium
- lycheeorg lycheeLychee: Missing Authentication for Critical Function and Allocation of Resources Without Limits or Throttling on /docs/api6.9 Medium
- lycheeorg lycheeLychee: A single 383-byte PDF causes ~184 seconds of CPU consumption in the real processing path7.1 High
- eclipse foundation connected services platformIn `api-gateway` versions till `1.7.3`, The default rate-limit key resolver, `ClientIpKeyResolver...6.5 Medium
- eclipse vert.xIn Eclipse Vert.x versions [4.0.0, 4.5.34] or [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0],...8.2 High
- eclipse vert.xIn Eclipse Vert.x versions [4.0.0, 4.5.34] or [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0],...8.2 High
- eclipse vert.xIn Eclipse Vert.x versions [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], the HTTP proxy...8.7 High
- eclipse vert.xIn Eclipse Vert.x versions [4.0.0, 4.5.34] or [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0],...8.7 High
- n8n-io n8nn8n before 2.41.4 and 2.42.1 Unauthenticated Unbounded OAuth Client Persistence via Authorize Endpoint8.2 High
- pipecat-ai pipecatPipecat: Public exposure of Pipecat’s development runner can allow unauthenticated bot session creation5.6 Medium
- modelcontextprotocol python-sdkModel Context Protocol Python SDK HTTP and OAuth endpoints allow memory exhaustion through unbounded request bodies7.5 High
- modelcontextprotocol io.modelcontextprotocol.sdk:mcp, io.modelcontextprotocol.sdk:mcp-core +1 moreModel Context Protocol Java SDK HTTP server transports allow memory exhaustion through unbounded request bodies7.5 High
- juniper networks junos osJunos OS: An attacker causes l2cpd crash when FNP is used with VLAN-VPLS encapsulation enabled7.1 High
- juniper networks junos os, junos os evolved +1 moreJunos OS and Junos OS Evolved: An attacker causes routing protocol daemon crash when OSPFv3 is enabled7.1 High
- modelcontextprotocol python-sdkMCP Python SDK: Unbounded Session Accumulation in StreamableHTTP Transport Enables Resource Exhaustion6.9 Medium
- Show moreLoading…